Why is primary domain controller is only using a source and sourcetype of XML files?

[brandoscommand0]

Hello, 

I'm dealing with an issue for one of my forwarders. I have13 forwarders that are all showing in my search app in the proper format. For some reason, the forwarder that also happens to be our primary domain controller is only using a source and sourcetype of xml files. Is there a way to troubleshoot this?

[richgalloway]

What is the search you are using to find the forwarders?

[brandoscommand0]

Thanks for the reply. 

To be a little more precise, I'm having an issue with just Account Management event codes coming up from an .xml source. So for instance, my primary domain controller will show the results I want when I type something like:

index="main" sourcetype="wineventlog"  host="pdc" eventcode="4625" 

So I will get X amount of failed logins that populate. 

Now, when I type the same but add a "4720" for account created, nothing will populate. 
However, if I replace the event code search for a keyword of the account I created, it will populate with the account creation event happening, but in xml which is not ideal. 

[richgalloway]

When you say "add a 4720" do you really mean "replace?  Adding an eventcode would create something like

index=main sourcetype=wineventlog host=pdc eventcode=4625 eventoode=4720

which would produce no results because no Windows event has more than one event code.

[brandoscommand0]

No, 

I would just have a singular event code showing. So for instance, I am able to see event code 4625 populate fine. However, any event code that has to do with account management (4720), does not populate and a more specific search only yields xml sources.